liudieyu0.blog124.fc2.com
http://liudieyu0.blog124.fc2.com/blog-entry-6.html CVE-2008-4582
Mozilla Firefox 3.0.3 - Internet Shortcut Same Origin Policy Violation
Record summary
CVE-2008-4582 has a selected CVSS score of 4.3; EIP currently links 1 catalogued exploit.
Description
Mozilla Firefox 3.0.1 through 3.0.3, Firefox 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13, when running on Windows, do not properly identify the context of Windows .url shortcut files, which allows user-assisted remote attackers to bypass the Same Origin Policy and obtain sensitive information via an HTML document that is directly accessible through a filesystem, as demonstrated by documents in (1) local folders, (2) Windows share folders, and (3) RAR archives, and as demonstrated by IFRAMEs referencing shortcuts that point to (a) about:cache?device=memory and (b) about:cache?device=disk, a variant of CVE-2008-2810.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 1
Proofs of concept
1Catalogued exploits
ExploitDBMozilla Firefox 3.0.3 - Internet Shortcut Same Origin Policy ViolationExploitDB exploitby Liu Die YuNot analyzed1 file
References
Showing 12 of 3332192Third-party advisory
http://secunia.com/advisories/32192 32684Third-party advisory
http://secunia.com/advisories/32684 32693Third-party advisory
http://secunia.com/advisories/32693 32714Third-party advisory
http://secunia.com/advisories/32714 32721Third-party advisory
http://secunia.com/advisories/32721 32778Third-party advisory
http://secunia.com/advisories/32778 32845Third-party advisory
http://secunia.com/advisories/32845 32853Third-party advisory
http://secunia.com/advisories/32853 33433Third-party advisory
http://secunia.com/advisories/33433 33434Third-party advisory
http://secunia.com/advisories/33434 34501Third-party advisory
http://secunia.com/advisories/34501